Hot answers tagged

21 votes
Accepted

How does NAT reflection (NAT loopback) work?

For a NAT to work properly both the packets from client to server and the packets from server to client must pass through the NAT. Note that the NAT table in iptables is only used for the first ...
user avatar
  • 3,920
10 votes
Accepted

GlusterFS how to failover (smartly) if a mounted Server is failed?

When you are doing this: mount -t glusterfs gluster-server-01:/volume-www /var/www You are initially connecting to one of the nodes that make up the Gluster volume, but the Gluster Native Client (...
user avatar
7 votes

"ssh -L <port>" only working from local machine

Try ssh -g -L ... From man ssh: -g Allows remote hosts to connect to local forwarded ports. If used on a multiplexed connection, then this option must be specified on the master process. ...
user avatar
  • 53.7k
6 votes
Accepted

Port forwarding & NAT with nftables

You are not translating the port number. When the external connection is to port 1234, this is not a problem. But when it is to 4321, the dnat passes through to port 4321 on the internal server, not ...
user avatar
5 votes

Send traffic to self over physical network on Ubuntu

Create a network namespace and move one of interfaces into it: ip netns add test ip link set eth1 netns test Start a shell in the new namespace: ip netns exec test bash Then proceed as if you had ...
user avatar
5 votes

How to override dns server in nat gateway (iptables)

not --sport 53, use --dport 53
user avatar
  • 13.7k
5 votes

Linux: Connect to two different networks with same ip range

Firstly, I don't have the option to test this really, so I'm bound to have some detail wrong, but essentially you'll need special routing to make some packets for address 10.5.5.9 to go out wlan1 and ...
user avatar
5 votes
Accepted

Access VM via static IP (NAT?)

You've to create a bridged network between the Host and VM. The configuration varies on Hypervisor vendor. In case you're using Oracle Virtual Box Open Oracle VM VirtualBox Manager, select the VM ...
user avatar
  • 2,030
4 votes
Accepted

Randomize external port when doing NAT with iptables

SNAT accepts a --random option (from iptables-extensions manpage): --random If option --random is used then port mapping will be randomized (kernel >= 2.6.21). So I'd try something ...
user avatar
  • 5,600
4 votes

Temporary redirect ports

You need at least iptables -I FORWARD 0 -d 192.168.77.4 -p tcp --dport 80 -j ACCEPT With -I FORWARD 0 you insert your own rule before the shorewall firewall rules which have a generic reject rule in ...
user avatar
  • 25.4k
4 votes

Routing internet on NAT server thru Squid proxy

To transparently intercept traffic use policy based routing via NAT to redirect the web traffic to the squid proxy, then intercept it. Set policy routing on your GW or NAT box, adjust the ip's and ...
user avatar
  • 8,300
4 votes
Accepted

Does NAT allow accessing internal network (or router's local interface) from outisde by default?

That's normal, and has nothing to do with NAT. Linux, by default, treats IP addresses as belonging to the machine¹, not to a particular interface. So it'll answer packets to 192.168.2.1 on any ...
user avatar
  • 102k
4 votes
Accepted

ssh connection refused from same PC when going outside local network

You won't be able to connect to the NAT'ed server name from the host which is the destination of the NAT. The reason is very simple NAT breaks TCP/IP in this case. Just walk through what's happening ...
user avatar
  • 851
4 votes

SSH connections frequently disconnected when using a mobile hotspot for internet access

There are three main reasons your ssh sessions (or other persistent connections) may be disrupted when using cellphone towers/a mobile hotspot for internet access: Your IP address is changing. This ...
user avatar
4 votes

Can a NAT router run out of ports?

If a router doing NAT uses an ephemeral port for each connection made to the internet on behalf of the hosts on the internal network, does this mean that it is possible for the router to run out of ...
user avatar
  • 90.4k
3 votes
Accepted

NAT box with multiple internal and external interfaces

OK, I figured it out. What I had to do was add the internal subnet route to each route table then set rules to control what interface traffic routes to/from. Then in iptables marking packets with ...
user avatar
3 votes
Accepted

How to configure QoS per IP basis?

You need to pick a class aware qdisc like HFSC or HTB. Then you'll have to build a class tree like this: Root Class (10MBit) | \--- XyZ Class (rate 3Mbit ceil 3Mbit) | | | \--- Client 10 (rate ...
user avatar
  • 42.5k
3 votes

GlusterFS how to failover (smartly) if a mounted Server is failed?

OpenUserX03's answer is not quite accurate. When a client connects to a Gluster server node, it receives information about all the nodes. After that, it starts communicating with multiple nodes ...
user avatar
3 votes

How does iptables MASQUERADE work on the incoming side?

In iptables only the first packet of a connection hits the chains in the nat table (this is different from chains in other tables). Packets related to an existing connection are translated ...
user avatar
  • 3,920
3 votes
Accepted

Enable ssh host to guest & guest Internet on CentOS 7 guest with VirtualBox

So I finally got it to work I was missing netmask value in the configuration Host only NIC enp0s3 TYPE=Ethernet BOOTPROTO=static NAME=enp0s3 UUID=71d4200e-199d-4d03-935d-6d2e88c41956 DEVICE=enp0s3 ...
user avatar
  • 151
3 votes

Networking issue with Virtualbox

Network connectivity to your VM - assuming of course that it has a properly configured service to connect to - depends on what network type you've chosen in the VM settings. 1) NAT - this does what ...
user avatar
  • 4,700
3 votes

iptables/netfilter: "nf_nat_ftp" is not working well with recent Linux kernels

I already answered it at superuser.com Basically newer kernels ( >= 4.7 ) are deprecating the automatic helper module's port assignment in favor of explicit rules. Short fix to get the old behaviour:...
user avatar
  • 25.1k
3 votes

Using Linux as router with nftables - masquerade not forwarding reply back

The nftables wiki states: "[...] you have to register the prerouting/postrouting chains even if you have no rules there since these chain will invoke the NAT engine for the packets coming in the ...
user avatar
  • 31
3 votes
Accepted

How To Configure a noip on linux, if I has Double NAT ISP Like JioFi?

Your ISP does NAT between its public IP (157.50.xx.xx) and the ISP internal private IP (10.89.xx.xx). Unless you can convince your ISP (by switching to the appropriate plan, usually for business, that ...
user avatar
  • 29.1k
3 votes
Accepted

Iptables NAT / Kernel IP forwarding limited to ~10Mbit

The Banana R1/Lamobo R1 while an interesting piece of hardware has too many shortcomings. Firstly, the "switch" internal interface bandwidth is shared. A theoretical 1GBps tops for all shared 5 ports;...
user avatar
3 votes

How can I access a virtual machine running on a remote machine directly?

Use ProxyJump or ProxyCommand. Add this to your ~/.ssh/config: Host vmhost User t Hostname 192.168.1.198 Host vm Hostname 192.168.122.169 User t ProxyJump vmhost or for older ...
user avatar
  • 20.7k
3 votes
Accepted

nat configuration for qemu-kvm guest and host networks

The MASQUERADE rule happens at POSTROUTING: that is after a routing decision was already made and a destination interface was already chosen. To communicate with outside, the host will use 192.168.117....
user avatar
  • 25.1k
3 votes
Accepted

How to share an IPv6 connection to the whole LAN?

Sure, if your IPv6 connection gives you a prefix that is large enough for all the devices in the LAN (i.e. a prefix number smaller than /128, ideally /64 or less). First, enable IPv6 forwarding by ...
user avatar
  • 68.6k
3 votes
Accepted

iptables rules to forward tftp via NAT

Since Linux 4.7 in 2016, the conntrack automatic helper assignment was disabled by default (after having years of warning about this in kernel messages): Four years ago we introduced a new sysctl ...
user avatar
  • 25.1k

Only top scored, non community-wiki answers of a minimum length are eligible